Use GitHub private vulnerability reporting. Do not open a public issue or pull request for a suspected vulnerability.

Include the affected version or commit, impact, affected command or path, a synthetic reproduction, and any suggested mitigation. Never include live credentials, .env contents, private keys, tokens, or private repository data.

Maintainers will coordinate triage and disclosure on a best-effort basis through the private advisory. GitHub Repo Doctor evaluates repository readiness; it is not a vulnerability scanner.